net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/a2mp.h>
  32 #include <net/bluetooth/smp.h>
  33
  34 static void hci_le_connect(struct hci_conn *conn)
  35 {
  36         struct hci_dev *hdev = conn->hdev;
  37         struct hci_cp_le_create_conn cp;
  38
  39         conn->state = BT_CONNECT;
  40         conn->out = true;
  41         conn->link_mode |= HCI_LM_MASTER;
  42         conn->sec_level = BT_SECURITY_LOW;
  43
  44         memset(&cp, 0, sizeof(cp));
  45         cp.scan_interval = __constant_cpu_to_le16(0x0060);
  46         cp.scan_window = __constant_cpu_to_le16(0x0030);
  47         bacpy(&cp.peer_addr, &conn->dst);
  48         cp.peer_addr_type = conn->dst_type;
  49         cp.conn_interval_min = __constant_cpu_to_le16(0x0028);
  50         cp.conn_interval_max = __constant_cpu_to_le16(0x0038);
  51         cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
  52         cp.min_ce_len = __constant_cpu_to_le16(0x0000);
  53         cp.max_ce_len = __constant_cpu_to_le16(0x0000);
  54
  55         hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
  56 }
  57
  58 static void hci_le_connect_cancel(struct hci_conn *conn)
  59 {
  60         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  61 }
  62
  63 void hci_acl_connect(struct hci_conn *conn)
  64 {
  65         struct hci_dev *hdev = conn->hdev;
  66         struct inquiry_entry *ie;
  67         struct hci_cp_create_conn cp;
  68
  69         BT_DBG("hcon %p", conn);
  70
  71         conn->state = BT_CONNECT;
  72         conn->out = true;
  73
  74         conn->link_mode = HCI_LM_MASTER;
  75
  76         conn->attempt++;
  77
  78         conn->link_policy = hdev->link_policy;
  79
  80         memset(&cp, 0, sizeof(cp));
  81         bacpy(&cp.bdaddr, &conn->dst);
  82         cp.pscan_rep_mode = 0x02;
  83
  84         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  85         if (ie) {
  86                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
  87                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
  88                         cp.pscan_mode     = ie->data.pscan_mode;
  89                         cp.clock_offset   = ie->data.clock_offset |
  90                                             __constant_cpu_to_le16(0x8000);
  91                 }
  92
  93                 memcpy(conn->dev_class, ie->data.dev_class, 3);
  94                 if (ie->data.ssp_mode > 0)
  95                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  96         }
  97
  98         cp.pkt_type = cpu_to_le16(conn->pkt_type);
  99         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 100                 cp.role_switch = 0x01;
 101         else
 102                 cp.role_switch = 0x00;
 103
 104         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 105 }
 106
 107 static void hci_acl_connect_cancel(struct hci_conn *conn)
 108 {
 109         struct hci_cp_create_conn_cancel cp;
 110
 111         BT_DBG("hcon %p", conn);
 112
 113         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 114                 return;
 115
 116         bacpy(&cp.bdaddr, &conn->dst);
 117         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 118 }
 119
 120 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 121 {
 122         struct hci_cp_disconnect cp;
 123
 124         BT_DBG("hcon %p", conn);
 125
 126         conn->state = BT_DISCONN;
 127
 128         cp.handle = cpu_to_le16(conn->handle);
 129         cp.reason = reason;
 130         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 131 }
 132
 133 void hci_add_sco(struct hci_conn *conn, __u16 handle)
 134 {
 135         struct hci_dev *hdev = conn->hdev;
 136         struct hci_cp_add_sco cp;
 137
 138         BT_DBG("hcon %p", conn);
 139
 140         conn->state = BT_CONNECT;
 141         conn->out = true;
 142
 143         conn->attempt++;
 144
 145         cp.handle   = cpu_to_le16(handle);
 146         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 147
 148         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 149 }
 150
 151 void hci_setup_sync(struct hci_conn *conn, __u16 handle)
 152 {
 153         struct hci_dev *hdev = conn->hdev;
 154         struct hci_cp_setup_sync_conn cp;
 155
 156         BT_DBG("hcon %p", conn);
 157
 158         conn->state = BT_CONNECT;
 159         conn->out = true;
 160
 161         conn->attempt++;
 162
 163         cp.handle   = cpu_to_le16(handle);
 164         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 165
 166         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 167         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 168         cp.max_latency    = __constant_cpu_to_le16(0xffff);
 169         cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
 170         cp.retrans_effort = 0xff;
 171
 172         hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
 173 }
 174
 175 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 176                         u16 latency, u16 to_multiplier)
 177 {
 178         struct hci_cp_le_conn_update cp;
 179         struct hci_dev *hdev = conn->hdev;
 180
 181         memset(&cp, 0, sizeof(cp));
 182
 183         cp.handle               = cpu_to_le16(conn->handle);
 184         cp.conn_interval_min    = cpu_to_le16(min);
 185         cp.conn_interval_max    = cpu_to_le16(max);
 186         cp.conn_latency         = cpu_to_le16(latency);
 187         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 188         cp.min_ce_len           = __constant_cpu_to_le16(0x0001);
 189         cp.max_ce_len           = __constant_cpu_to_le16(0x0001);
 190
 191         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 192 }
 193
 194 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 195                       __u8 ltk[16])
 196 {
 197         struct hci_dev *hdev = conn->hdev;
 198         struct hci_cp_le_start_enc cp;
 199
 200         BT_DBG("hcon %p", conn);
 201
 202         memset(&cp, 0, sizeof(cp));
 203
 204         cp.handle = cpu_to_le16(conn->handle);
 205         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 206         cp.ediv = ediv;
 207         memcpy(cp.rand, rand, sizeof(cp.rand));
 208
 209         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 210 }
 211
 212 /* Device _must_ be locked */
 213 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 214 {
 215         struct hci_conn *sco = conn->link;
 216
 217         if (!sco)
 218                 return;
 219
 220         BT_DBG("hcon %p", conn);
 221
 222         if (!status) {
 223                 if (lmp_esco_capable(conn->hdev))
 224                         hci_setup_sync(sco, conn->handle);
 225                 else
 226                         hci_add_sco(sco, conn->handle);
 227         } else {
 228                 hci_proto_connect_cfm(sco, status);
 229                 hci_conn_del(sco);
 230         }
 231 }
 232
 233 static void hci_conn_timeout(struct work_struct *work)
 234 {
 235         struct hci_conn *conn = container_of(work, struct hci_conn,
 236                                              disc_work.work);
 237         __u8 reason;
 238
 239         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 240
 241         if (atomic_read(&conn->refcnt))
 242                 return;
 243
 244         switch (conn->state) {
 245         case BT_CONNECT:
 246         case BT_CONNECT2:
 247                 if (conn->out) {
 248                         if (conn->type == ACL_LINK)
 249                                 hci_acl_connect_cancel(conn);
 250                         else if (conn->type == LE_LINK)
 251                                 hci_le_connect_cancel(conn);
 252                 }
 253                 break;
 254         case BT_CONFIG:
 255         case BT_CONNECTED:
 256                 reason = hci_proto_disconn_ind(conn);
 257                 hci_acl_disconn(conn, reason);
 258                 break;
 259         default:
 260                 conn->state = BT_CLOSED;
 261                 break;
 262         }
 263 }
 264
 265 /* Enter sniff mode */
 266 static void hci_conn_enter_sniff_mode(struct hci_conn *conn)
 267 {
 268         struct hci_dev *hdev = conn->hdev;
 269
 270         BT_DBG("hcon %p mode %d", conn, conn->mode);
 271
 272         if (test_bit(HCI_RAW, &hdev->flags))
 273                 return;
 274
 275         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 276                 return;
 277
 278         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 279                 return;
 280
 281         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 282                 struct hci_cp_sniff_subrate cp;
 283                 cp.handle             = cpu_to_le16(conn->handle);
 284                 cp.max_latency        = __constant_cpu_to_le16(0);
 285                 cp.min_remote_timeout = __constant_cpu_to_le16(0);
 286                 cp.min_local_timeout  = __constant_cpu_to_le16(0);
 287                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 288         }
 289
 290         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 291                 struct hci_cp_sniff_mode cp;
 292                 cp.handle       = cpu_to_le16(conn->handle);
 293                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 294                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 295                 cp.attempt      = __constant_cpu_to_le16(4);
 296                 cp.timeout      = __constant_cpu_to_le16(1);
 297                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 298         }
 299 }
 300
 301 static void hci_conn_idle(unsigned long arg)
 302 {
 303         struct hci_conn *conn = (void *) arg;
 304
 305         BT_DBG("hcon %p mode %d", conn, conn->mode);
 306
 307         hci_conn_enter_sniff_mode(conn);
 308 }
 309
 310 static void hci_conn_auto_accept(unsigned long arg)
 311 {
 312         struct hci_conn *conn = (void *) arg;
 313         struct hci_dev *hdev = conn->hdev;
 314
 315         hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 316                      &conn->dst);
 317 }
 318
 319 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 320 {
 321         struct hci_conn *conn;
 322
 323         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 324
 325         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 326         if (!conn)
 327                 return NULL;
 328
 329         bacpy(&conn->dst, dst);
 330         conn->hdev  = hdev;
 331         conn->type  = type;
 332         conn->mode  = HCI_CM_ACTIVE;
 333         conn->state = BT_OPEN;
 334         conn->auth_type = HCI_AT_GENERAL_BONDING;
 335         conn->io_capability = hdev->io_capability;
 336         conn->remote_auth = 0xff;
 337         conn->key_type = 0xff;
 338
 339         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 340         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 341
 342         switch (type) {
 343         case ACL_LINK:
 344                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 345                 break;
 346         case SCO_LINK:
 347                 if (lmp_esco_capable(hdev))
 348                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 349                                         (hdev->esco_type & EDR_ESCO_MASK);
 350                 else
 351                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 352                 break;
 353         case ESCO_LINK:
 354                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 355                 break;
 356         }
 357
 358         skb_queue_head_init(&conn->data_q);
 359
 360         INIT_LIST_HEAD(&conn->chan_list);
 361
 362         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 363         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
 364         setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
 365                     (unsigned long) conn);
 366
 367         atomic_set(&conn->refcnt, 0);
 368
 369         hci_dev_hold(hdev);
 370
 371         hci_conn_hash_add(hdev, conn);
 372         if (hdev->notify)
 373                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 374
 375         atomic_set(&conn->devref, 0);
 376
 377         hci_conn_init_sysfs(conn);
 378
 379         return conn;
 380 }
 381
 382 int hci_conn_del(struct hci_conn *conn)
 383 {
 384         struct hci_dev *hdev = conn->hdev;
 385
 386         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 387
 388         del_timer(&conn->idle_timer);
 389
 390         cancel_delayed_work_sync(&conn->disc_work);
 391
 392         del_timer(&conn->auto_accept_timer);
 393
 394         if (conn->type == ACL_LINK) {
 395                 struct hci_conn *sco = conn->link;
 396                 if (sco)
 397                         sco->link = NULL;
 398
 399                 /* Unacked frames */
 400                 hdev->acl_cnt += conn->sent;
 401         } else if (conn->type == LE_LINK) {
 402                 if (hdev->le_pkts)
 403                         hdev->le_cnt += conn->sent;
 404                 else
 405                         hdev->acl_cnt += conn->sent;
 406         } else {
 407                 struct hci_conn *acl = conn->link;
 408                 if (acl) {
 409                         acl->link = NULL;
 410                         hci_conn_put(acl);
 411                 }
 412         }
 413
 414         hci_chan_list_flush(conn);
 415
 416         if (conn->amp_mgr)
 417                 amp_mgr_put(conn->amp_mgr);
 418
 419         hci_conn_hash_del(hdev, conn);
 420         if (hdev->notify)
 421                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 422
 423         skb_queue_purge(&conn->data_q);
 424
 425         hci_conn_put_device(conn);
 426
 427         hci_dev_put(hdev);
 428
 429         if (conn->handle == 0)
 430                 kfree(conn);
 431
 432         return 0;
 433 }
 434
 435 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 436 {
 437         int use_src = bacmp(src, BDADDR_ANY);
 438         struct hci_dev *hdev = NULL, *d;
 439
 440         BT_DBG("%s -> %s", batostr(src), batostr(dst));
 441
 442         read_lock(&hci_dev_list_lock);
 443
 444         list_for_each_entry(d, &hci_dev_list, list) {
 445                 if (!test_bit(HCI_UP, &d->flags) ||
 446                     test_bit(HCI_RAW, &d->flags) ||
 447                     d->dev_type != HCI_BREDR)
 448                         continue;
 449
 450                 /* Simple routing:
 451                  *   No source address - find interface with bdaddr != dst
 452                  *   Source address    - find interface with bdaddr == src
 453                  */
 454
 455                 if (use_src) {
 456                         if (!bacmp(&d->bdaddr, src)) {
 457                                 hdev = d; break;
 458                         }
 459                 } else {
 460                         if (bacmp(&d->bdaddr, dst)) {
 461                                 hdev = d; break;
 462                         }
 463                 }
 464         }
 465
 466         if (hdev)
 467                 hdev = hci_dev_hold(hdev);
 468
 469         read_unlock(&hci_dev_list_lock);
 470         return hdev;
 471 }
 472 EXPORT_SYMBOL(hci_get_route);
 473
 474 /* Create SCO, ACL or LE connection.
 475  * Device _must_ be locked */
 476 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
 477                              __u8 dst_type, __u8 sec_level, __u8 auth_type)
 478 {
 479         struct hci_conn *acl;
 480         struct hci_conn *sco;
 481         struct hci_conn *le;
 482
 483         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 484
 485         if (type == LE_LINK) {
 486                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 487                 if (!le) {
 488                         le = hci_conn_hash_lookup_state(hdev, LE_LINK,
 489                                                         BT_CONNECT);
 490                         if (le)
 491                                 return ERR_PTR(-EBUSY);
 492
 493                         le = hci_conn_add(hdev, LE_LINK, dst);
 494                         if (!le)
 495                                 return ERR_PTR(-ENOMEM);
 496
 497                         le->dst_type = bdaddr_to_le(dst_type);
 498                         hci_le_connect(le);
 499                 }
 500
 501                 le->pending_sec_level = sec_level;
 502                 le->auth_type = auth_type;
 503
 504                 hci_conn_hold(le);
 505
 506                 return le;
 507         }
 508
 509         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 510         if (!acl) {
 511                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 512                 if (!acl)
 513                         return ERR_PTR(-ENOMEM);
 514         }
 515
 516         hci_conn_hold(acl);
 517
 518         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 519                 acl->sec_level = BT_SECURITY_LOW;
 520                 acl->pending_sec_level = sec_level;
 521                 acl->auth_type = auth_type;
 522                 hci_acl_connect(acl);
 523         }
 524
 525         if (type == ACL_LINK)
 526                 return acl;
 527
 528         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 529         if (!sco) {
 530                 sco = hci_conn_add(hdev, type, dst);
 531                 if (!sco) {
 532                         hci_conn_put(acl);
 533                         return ERR_PTR(-ENOMEM);
 534                 }
 535         }
 536
 537         acl->link = sco;
 538         sco->link = acl;
 539
 540         hci_conn_hold(sco);
 541
 542         if (acl->state == BT_CONNECTED &&
 543             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 544                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 545                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 546
 547                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 548                         /* defer SCO setup until mode change completed */
 549                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 550                         return sco;
 551                 }
 552
 553                 hci_sco_setup(acl, 0x00);
 554         }
 555
 556         return sco;
 557 }
 558
 559 /* Check link security requirement */
 560 int hci_conn_check_link_mode(struct hci_conn *conn)
 561 {
 562         BT_DBG("hcon %p", conn);
 563
 564         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 565                 return 0;
 566
 567         return 1;
 568 }
 569
 570 /* Authenticate remote device */
 571 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 572 {
 573         BT_DBG("hcon %p", conn);
 574
 575         if (conn->pending_sec_level > sec_level)
 576                 sec_level = conn->pending_sec_level;
 577
 578         if (sec_level > conn->sec_level)
 579                 conn->pending_sec_level = sec_level;
 580         else if (conn->link_mode & HCI_LM_AUTH)
 581                 return 1;
 582
 583         /* Make sure we preserve an existing MITM requirement*/
 584         auth_type |= (conn->auth_type & 0x01);
 585
 586         conn->auth_type = auth_type;
 587
 588         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 589                 struct hci_cp_auth_requested cp;
 590
 591                 /* encrypt must be pending if auth is also pending */
 592                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 593
 594                 cp.handle = cpu_to_le16(conn->handle);
 595                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 596                              sizeof(cp), &cp);
 597                 if (conn->key_type != 0xff)
 598                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 599         }
 600
 601         return 0;
 602 }
 603
 604 /* Encrypt the the link */
 605 static void hci_conn_encrypt(struct hci_conn *conn)
 606 {
 607         BT_DBG("hcon %p", conn);
 608
 609         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 610                 struct hci_cp_set_conn_encrypt cp;
 611                 cp.handle  = cpu_to_le16(conn->handle);
 612                 cp.encrypt = 0x01;
 613                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 614                              &cp);
 615         }
 616 }
 617
 618 /* Enable security */
 619 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 620 {
 621         BT_DBG("hcon %p", conn);
 622
 623         if (conn->type == LE_LINK)
 624                 return smp_conn_security(conn, sec_level);
 625
 626         /* For sdp we don't need the link key. */
 627         if (sec_level == BT_SECURITY_SDP)
 628                 return 1;
 629
 630         /* For non 2.1 devices and low security level we don't need the link
 631            key. */
 632         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 633                 return 1;
 634
 635         /* For other security levels we need the link key. */
 636         if (!(conn->link_mode & HCI_LM_AUTH))
 637                 goto auth;
 638
 639         /* An authenticated combination key has sufficient security for any
 640            security level. */
 641         if (conn->key_type == HCI_LK_AUTH_COMBINATION)
 642                 goto encrypt;
 643
 644         /* An unauthenticated combination key has sufficient security for
 645            security level 1 and 2. */
 646         if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
 647             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
 648                 goto encrypt;
 649
 650         /* A combination key has always sufficient security for the security
 651            levels 1 or 2. High security level requires the combination key
 652            is generated using maximum PIN code length (16).
 653            For pre 2.1 units. */
 654         if (conn->key_type == HCI_LK_COMBINATION &&
 655             (sec_level != BT_SECURITY_HIGH || conn->pin_length == 16))
 656                 goto encrypt;
 657
 658 auth:
 659         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 660                 return 0;
 661
 662         if (!hci_conn_auth(conn, sec_level, auth_type))
 663                 return 0;
 664
 665 encrypt:
 666         if (conn->link_mode & HCI_LM_ENCRYPT)
 667                 return 1;
 668
 669         hci_conn_encrypt(conn);
 670         return 0;
 671 }
 672 EXPORT_SYMBOL(hci_conn_security);
 673
 674 /* Check secure link requirement */
 675 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 676 {
 677         BT_DBG("hcon %p", conn);
 678
 679         if (sec_level != BT_SECURITY_HIGH)
 680                 return 1; /* Accept if non-secure is required */
 681
 682         if (conn->sec_level == BT_SECURITY_HIGH)
 683                 return 1;
 684
 685         return 0; /* Reject not secure link */
 686 }
 687 EXPORT_SYMBOL(hci_conn_check_secure);
 688
 689 /* Change link key */
 690 int hci_conn_change_link_key(struct hci_conn *conn)
 691 {
 692         BT_DBG("hcon %p", conn);
 693
 694         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 695                 struct hci_cp_change_conn_link_key cp;
 696                 cp.handle = cpu_to_le16(conn->handle);
 697                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 698                              sizeof(cp), &cp);
 699         }
 700
 701         return 0;
 702 }
 703
 704 /* Switch role */
 705 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 706 {
 707         BT_DBG("hcon %p", conn);
 708
 709         if (!role && conn->link_mode & HCI_LM_MASTER)
 710                 return 1;
 711
 712         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
 713                 struct hci_cp_switch_role cp;
 714                 bacpy(&cp.bdaddr, &conn->dst);
 715                 cp.role = role;
 716                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 717         }
 718
 719         return 0;
 720 }
 721 EXPORT_SYMBOL(hci_conn_switch_role);
 722
 723 /* Enter active mode */
 724 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 725 {
 726         struct hci_dev *hdev = conn->hdev;
 727
 728         BT_DBG("hcon %p mode %d", conn, conn->mode);
 729
 730         if (test_bit(HCI_RAW, &hdev->flags))
 731                 return;
 732
 733         if (conn->mode != HCI_CM_SNIFF)
 734                 goto timer;
 735
 736         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
 737                 goto timer;
 738
 739         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 740                 struct hci_cp_exit_sniff_mode cp;
 741                 cp.handle = cpu_to_le16(conn->handle);
 742                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 743         }
 744
 745 timer:
 746         if (hdev->idle_timeout > 0)
 747                 mod_timer(&conn->idle_timer,
 748                           jiffies + msecs_to_jiffies(hdev->idle_timeout));
 749 }
 750
 751 /* Drop all connection on the device */
 752 void hci_conn_hash_flush(struct hci_dev *hdev)
 753 {
 754         struct hci_conn_hash *h = &hdev->conn_hash;
 755         struct hci_conn *c, *n;
 756
 757         BT_DBG("hdev %s", hdev->name);
 758
 759         list_for_each_entry_safe(c, n, &h->list, list) {
 760                 c->state = BT_CLOSED;
 761
 762                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
 763                 hci_conn_del(c);
 764         }
 765 }
 766
 767 /* Check pending connect attempts */
 768 void hci_conn_check_pending(struct hci_dev *hdev)
 769 {
 770         struct hci_conn *conn;
 771
 772         BT_DBG("hdev %s", hdev->name);
 773
 774         hci_dev_lock(hdev);
 775
 776         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
 777         if (conn)
 778                 hci_acl_connect(conn);
 779
 780         hci_dev_unlock(hdev);
 781 }
 782
 783 void hci_conn_hold_device(struct hci_conn *conn)
 784 {
 785         atomic_inc(&conn->devref);
 786 }
 787 EXPORT_SYMBOL(hci_conn_hold_device);
 788
 789 void hci_conn_put_device(struct hci_conn *conn)
 790 {
 791         if (atomic_dec_and_test(&conn->devref))
 792                 hci_conn_del_sysfs(conn);
 793 }
 794 EXPORT_SYMBOL(hci_conn_put_device);
 795
 796 int hci_get_conn_list(void __user *arg)
 797 {
 798         struct hci_conn *c;
 799         struct hci_conn_list_req req, *cl;
 800         struct hci_conn_info *ci;
 801         struct hci_dev *hdev;
 802         int n = 0, size, err;
 803
 804         if (copy_from_user(&req, arg, sizeof(req)))
 805                 return -EFAULT;
 806
 807         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
 808                 return -EINVAL;
 809
 810         size = sizeof(req) + req.conn_num * sizeof(*ci);
 811
 812         cl = kmalloc(size, GFP_KERNEL);
 813         if (!cl)
 814                 return -ENOMEM;
 815
 816         hdev = hci_dev_get(req.dev_id);
 817         if (!hdev) {
 818                 kfree(cl);
 819                 return -ENODEV;
 820         }
 821
 822         ci = cl->conn_info;
 823
 824         hci_dev_lock(hdev);
 825         list_for_each_entry(c, &hdev->conn_hash.list, list) {
 826                 bacpy(&(ci + n)->bdaddr, &c->dst);
 827                 (ci + n)->handle = c->handle;
 828                 (ci + n)->type  = c->type;
 829                 (ci + n)->out   = c->out;
 830                 (ci + n)->state = c->state;
 831                 (ci + n)->link_mode = c->link_mode;
 832                 if (++n >= req.conn_num)
 833                         break;
 834         }
 835         hci_dev_unlock(hdev);
 836
 837         cl->dev_id = hdev->id;
 838         cl->conn_num = n;
 839         size = sizeof(req) + n * sizeof(*ci);
 840
 841         hci_dev_put(hdev);
 842
 843         err = copy_to_user(arg, cl, size);
 844         kfree(cl);
 845
 846         return err ? -EFAULT : 0;
 847 }
 848
 849 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
 850 {
 851         struct hci_conn_info_req req;
 852         struct hci_conn_info ci;
 853         struct hci_conn *conn;
 854         char __user *ptr = arg + sizeof(req);
 855
 856         if (copy_from_user(&req, arg, sizeof(req)))
 857                 return -EFAULT;
 858
 859         hci_dev_lock(hdev);
 860         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
 861         if (conn) {
 862                 bacpy(&ci.bdaddr, &conn->dst);
 863                 ci.handle = conn->handle;
 864                 ci.type  = conn->type;
 865                 ci.out   = conn->out;
 866                 ci.state = conn->state;
 867                 ci.link_mode = conn->link_mode;
 868         }
 869         hci_dev_unlock(hdev);
 870
 871         if (!conn)
 872                 return -ENOENT;
 873
 874         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
 875 }
 876
 877 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
 878 {
 879         struct hci_auth_info_req req;
 880         struct hci_conn *conn;
 881
 882         if (copy_from_user(&req, arg, sizeof(req)))
 883                 return -EFAULT;
 884
 885         hci_dev_lock(hdev);
 886         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
 887         if (conn)
 888                 req.type = conn->auth_type;
 889         hci_dev_unlock(hdev);
 890
 891         if (!conn)
 892                 return -ENOENT;
 893
 894         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
 895 }
 896
 897 struct hci_chan *hci_chan_create(struct hci_conn *conn)
 898 {
 899         struct hci_dev *hdev = conn->hdev;
 900         struct hci_chan *chan;
 901
 902         BT_DBG("%s hcon %p", hdev->name, conn);
 903
 904         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
 905         if (!chan)
 906                 return NULL;
 907
 908         chan->conn = conn;
 909         skb_queue_head_init(&chan->data_q);
 910
 911         list_add_rcu(&chan->list, &conn->chan_list);
 912
 913         return chan;
 914 }
 915
 916 int hci_chan_del(struct hci_chan *chan)
 917 {
 918         struct hci_conn *conn = chan->conn;
 919         struct hci_dev *hdev = conn->hdev;
 920
 921         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
 922
 923         list_del_rcu(&chan->list);
 924
 925         synchronize_rcu();
 926
 927         skb_queue_purge(&chan->data_q);
 928         kfree(chan);
 929
 930         return 0;
 931 }
 932
 933 void hci_chan_list_flush(struct hci_conn *conn)
 934 {
 935         struct hci_chan *chan, *n;
 936
 937         BT_DBG("hcon %p", conn);
 938
 939         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
 940                 hci_chan_del(chan);
 941 }